Analysis
- max time kernel
147s - max time network
119s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:32
Static task
static1
Behavioral task
behavioral1
Sample
TNT Original Invoice.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target TNT Original Invoice.exe
- Size 926KB
- Sample201109-e4ldawndve
- SHA256 d5220f4247fa62c2d9715642ee1ee8fee7e9d34b41edda242e4ad1d90e96622e
- MD5 0931191bd5086458d70a91e4ad4a5281
- SHA1 2fe9457a90871f994f717377113dc8ecd42307e9
- SHA512 d83cbe2228dbdf704b83c9d680fc5b582b5b1f99403dc87df10b6940c675456e173d1de95e182795fecdee4778df6bf883792837d19cabcd75ef28dada435bf1
- MD5 SHA1 SHA512
Malware Config
Signatures
- ServiceHost packer 22 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/1940-20-0x0000000000480BAE-mapping.dmp servicehost behavioral2/memory/1940-22-0x0000000000480BAE-mapping.dmp servicehost behavioral2/memory/1940-25-0x0000000000480BAE-mapping.dmp servicehost behavioral2/memory/1940-24-0x0000000000480BAE-mapping.dmp servicehost behavioral2/memory/1940-23-0x0000000000480BAE-mapping.dmp servicehost behavioral2/memory/1940-21-0x0000000000480BAE-mapping.dmp servicehost behavioral2/memory/1940-26-0x0000000000480BAE-mapping.dmp servicehost behavioral2/memory/1940-28-0x0000000000480BAE-mapping.dmp servicehost behavioral2/memory/1940-30-0x0000000000480BAE-mapping.dmp servicehost behavioral2/memory/1940-31-0x0000000000480BAE-mapping.dmp servicehost behavioral2/memory/1940-32-0x0000000000480BAE-mapping.dmp servicehost behavioral2/memory/1940-33-0x0000000000480BAE-mapping.dmp servicehost behavioral2/memory/1940-34-0x0000000000480BAE-mapping.dmp servicehost behavioral2/memory/1940-35-0x0000000000480BAE-mapping.dmp servicehost behavioral2/memory/1940-37-0x0000000000480BAE-mapping.dmp servicehost behavioral2/memory/1940-36-0x0000000000480BAE-mapping.dmp servicehost behavioral2/memory/1940-39-0x0000000000480BAE-mapping.dmp servicehost behavioral2/memory/1940-38-0x0000000000480BAE-mapping.dmp servicehost behavioral2/memory/1940-29-0x0000000000480BAE-mapping.dmp servicehost behavioral2/memory/1940-27-0x0000000000480BAE-mapping.dmp servicehost behavioral2/memory/1940-41-0x0000000000480BAE-mapping.dmp servicehost behavioral2/memory/1940-40-0x0000000000480BAE-mapping.dmp servicehost - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Uses the VBS compiler for execution 1 TTPs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 whatismyipaddress.com 13 whatismyipaddress.com - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 756 set thread context of 1940 756 TNT Original Invoice.exe 78 PID 1940 set thread context of 2844 1940 TNT Original Invoice.exe 82 PID 1940 set thread context of 3388 1940 TNT Original Invoice.exe 83 - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 200 schtasks.exe - Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 756 TNT Original Invoice.exe 756 TNT Original Invoice.exe 756 TNT Original Invoice.exe 756 TNT Original Invoice.exe 756 TNT Original Invoice.exe 756 TNT Original Invoice.exe 3388 vbc.exe 3388 vbc.exe 1940 TNT Original Invoice.exe 864 dw20.exe 864 dw20.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 756 TNT Original Invoice.exe Token: SeDebugPrivilege 1940 TNT Original Invoice.exe Token: SeRestorePrivilege 864 dw20.exe Token: SeBackupPrivilege 864 dw20.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1940 TNT Original Invoice.exe - Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 756 wrote to memory of 200 756 TNT Original Invoice.exe 75 PID 756 wrote to memory of 200 756 TNT Original Invoice.exe 75 PID 756 wrote to memory of 200 756 TNT Original Invoice.exe 75 PID 756 wrote to memory of 4060 756 TNT Original Invoice.exe 77 PID 756 wrote to memory of 4060 756 TNT Original Invoice.exe 77 PID 756 wrote to memory of 4060 756 TNT Original Invoice.exe 77 PID 756 wrote to memory of 1940 756 TNT Original Invoice.exe 78 PID 756 wrote to memory of 1940 756 TNT Original Invoice.exe 78 PID 756 wrote to memory of 1940 756 TNT Original Invoice.exe 78 PID 756 wrote to memory of 1940 756 TNT Original Invoice.exe 78 PID 756 wrote to memory of 1940 756 TNT Original Invoice.exe 78 PID 756 wrote to memory of 1940 756 TNT Original Invoice.exe 78 PID 756 wrote to memory of 1940 756 TNT Original Invoice.exe 78 PID 756 wrote to memory of 1940 756 TNT Original Invoice.exe 78 PID 1940 wrote to memory of 2844 1940 TNT Original Invoice.exe 82 PID 1940 wrote to memory of 2844 1940 TNT Original Invoice.exe 82 PID 1940 wrote to memory of 2844 1940 TNT Original Invoice.exe 82 PID 1940 wrote to memory of 2844 1940 TNT Original Invoice.exe 82 PID 1940 wrote to memory of 2844 1940 TNT Original Invoice.exe 82 PID 1940 wrote to memory of 2844 1940 TNT Original Invoice.exe 82 PID 1940 wrote to memory of 2844 1940 TNT Original Invoice.exe 82 PID 1940 wrote to memory of 2844 1940 TNT Original Invoice.exe 82 PID 1940 wrote to memory of 2844 1940 TNT Original Invoice.exe 82 PID 1940 wrote to memory of 3388 1940 TNT Original Invoice.exe 83 PID 1940 wrote to memory of 3388 1940 TNT Original Invoice.exe 83 PID 1940 wrote to memory of 3388 1940 TNT Original Invoice.exe 83 PID 1940 wrote to memory of 3388 1940 TNT Original Invoice.exe 83 PID 1940 wrote to memory of 3388 1940 TNT Original Invoice.exe 83 PID 1940 wrote to memory of 3388 1940 TNT Original Invoice.exe 83 PID 1940 wrote to memory of 3388 1940 TNT Original Invoice.exe 83 PID 1940 wrote to memory of 3388 1940 TNT Original Invoice.exe 83 PID 1940 wrote to memory of 3388 1940 TNT Original Invoice.exe 83 PID 1940 wrote to memory of 864 1940 TNT Original Invoice.exe 84 PID 1940 wrote to memory of 864 1940 TNT Original Invoice.exe 84 PID 1940 wrote to memory of 864 1940 TNT Original Invoice.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.exe"C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rfCzGXvzDWs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4ADA.tmp"2⤵
- Creates scheduled task(s)
PID:200
-
-
C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.exe"{path}"2⤵PID:4060
-
-
C:\Users\Admin\AppData\Local\Temp\TNT Original Invoice.exe"{path}"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵PID:2844
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3388
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 25443⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:864
-
-